From cf68b5ba05549950a7b9167f97e2ec0b1b2a2e42 Mon Sep 17 00:00:00 2001 From: Jack Grigg Date: Mon, 15 Feb 2021 14:26:29 +0000 Subject: [PATCH 1/3] book: Clarify meaning of "evaluation point" in our context Polynomial evaluation points and elliptic curve points are both things we rely on, but never in the same context (we either use elliptic curve points inside circuits, or implement proving systems on top of them). --- book/src/background/polynomials.md | 11 ++++++++++- book/src/background/upa.md | 6 +++--- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/book/src/background/polynomials.md b/book/src/background/polynomials.md index 5e4c164..257bf1f 100644 --- a/book/src/background/polynomials.md +++ b/book/src/background/polynomials.md @@ -7,7 +7,16 @@ A(X) = a_0 + a_1 X + a_2 X^2 + a_3 X^3 $$ defines a degree-$3$ polynomial. $a_0$ is referred to as the constant term. Polynomials of -degree $n-1$ have $n$ coefficients. +degree $n-1$ have $n$ coefficients. We will often want to compute the result of replacing +the formal indeterminate $X$ with some concrete value $x$, which we denote by $A(x)$. + +> In mathematics this is commonly referred to as "evaluating $A(X)$ at a point $x$". +> The word "point" here stems from the geometrical usage of polynomials in the form +> $y = A(x)$, where $(x, y)$ is the coordinate of a point in two-dimensional space. +> However, the polynomials we deal with are almost always constrained to equal zero, and +> $x$ will be an [element of some group](fields.md#groups). This should not be confused +> with points on an [elliptic curve](curves.md), which we also make use of, but never in +> the context of polynomial evaluation. Important notes: diff --git a/book/src/background/upa.md b/book/src/background/upa.md index 3a4000b..260b1a5 100644 --- a/book/src/background/upa.md +++ b/book/src/background/upa.md @@ -5,11 +5,11 @@ We call the field over which the circuit is defined $\mathbb{F} = \mathbb{F}_p$. Let $n = 2^k$, and assume that $\omega$ is a primitive root of unity of order $n$ in $\mathbb{F}^\times$, so that $\mathbb{F}^\times$ has a multiplicative subgroup $\mathcal{H} = \{1, \omega, \omega^2, \cdots, \omega^{n-1}\}$. This forms a Lagrange -basis corresponding to the points in the subgroup. +basis corresponding to the elements in the subgroup. ## Polynomial rules A polynomial rule defines a constraint that must hold between its specified columns at -every row (i.e. at every point in the multiplicative subgroup). +every row (i.e. at every element in the multiplicative subgroup). e.g. @@ -59,7 +59,7 @@ Reference: [Generic Lookups with PLONK (DRAFT)](/LTPc5f-3S0qNF6MtwD-Tdg?view) ### Vanishing argument We want to check that the expressions defined by the gate constraints, permutation -constraints and loookup constraints evaluate to zero at all points in the multiplicative +constraints and loookup constraints evaluate to zero at all elements in the multiplicative subgroup. To do this, the prover collapses all the expressions into one polynomial $$H(X) = \sum_{i=0}^e y^i E_i(X),$$ where $e$ is the number of expressions and $y$ is a random challenge used to keep the From ba9917e35c08ef05d2d846d44325980409d95176 Mon Sep 17 00:00:00 2001 From: Jack Grigg Date: Mon, 15 Feb 2021 14:30:25 +0000 Subject: [PATCH 2/3] book: Linkify URLs in references --- book/src/background/curves.md | 2 +- book/src/background/fields.md | 2 +- book/src/background/polynomials.md | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/book/src/background/curves.md b/book/src/background/curves.md index 4e55dde..fc29303 100644 --- a/book/src/background/curves.md +++ b/book/src/background/curves.md @@ -249,4 +249,4 @@ framework used in the Internet Draft makes use of several functions: Reference: https://eprint.iacr.org/2019/403.pdf ## References -[^complete-formulae]: Renes, J., Costello, C., & Batina, L. (2016, May). "Complete addition formulas for prime order elliptic curves." In Annual International Conference on the Theory and Applications of Cryptographic Techniques (pp. 403-428). Springer, Berlin, Heidelberg. https://eprint.iacr.org/2015/1060.pdf +[^complete-formulae]: [Renes, J., Costello, C., & Batina, L. (2016, May). "Complete addition formulas for prime order elliptic curves." In Annual International Conference on the Theory and Applications of Cryptographic Techniques (pp. 403-428). Springer, Berlin, Heidelberg.](https://eprint.iacr.org/2015/1060) diff --git a/book/src/background/fields.md b/book/src/background/fields.md index 8947844..d793356 100644 --- a/book/src/background/fields.md +++ b/book/src/background/fields.md @@ -294,4 +294,4 @@ Important notes: of unity). There is a two-to-one mapping between the elements and their squares. ## References -[^chinese-remainder]: Friedman, R. (n.d.) "Cyclic Groups and Elementary Number Theory II" (p. 5). http://www.math.columbia.edu/~rf/numbertheory2.pdf +[^chinese-remainder]: [Friedman, R. (n.d.) "Cyclic Groups and Elementary Number Theory II" (p. 5).](http://www.math.columbia.edu/~rf/numbertheory2.pdf) diff --git a/book/src/background/polynomials.md b/book/src/background/polynomials.md index 257bf1f..afaf826 100644 --- a/book/src/background/polynomials.md +++ b/book/src/background/polynomials.md @@ -282,8 +282,8 @@ $$A(X) = \sum_{i = 0}^{n-1} A(x_i)\mathcal{L_i}(X), $$ where $X \in \{x_0, x_1,\cdots, x_{1-n}\}.$ ## References -[^master-thm]: Dasgupta, S., Papadimitriou, C. H., & Vazirani, U. V. (2008). "Algorithms" (ch. 2). New York: McGraw-Hill Higher Education. https://people.eecs.berkeley.edu/~vazirani/algorithms/chap2.pdf +[^master-thm]: [Dasgupta, S., Papadimitriou, C. H., & Vazirani, U. V. (2008). "Algorithms" (ch. 2). New York: McGraw-Hill Higher Education.](https://people.eecs.berkeley.edu/~vazirani/algorithms/chap2.pdf) -[^ifft]: http://www.cs.ust.hk/mjg_lib/Classes/COMP3711H_Fall16/lectures/FFT_Slides.pdf +[^ifft]: [Golin, M. (2016). "The Fast Fourier Transform and Polynomial Multiplication" [lecture notes], COMP 3711H Design and Analysis of Algorithms, Hong Kong University of Science and Technology.](http://www.cs.ust.hk/mjg_lib/Classes/COMP3711H_Fall16/lectures/FFT_Slides.pdf) -[^barycentric]: Berrut, J. and Trefethen, L. (2004). "Barycentric Lagrange Interpolation." https://people.maths.ox.ac.uk/trefethen/barycentric.pdf +[^barycentric]: [Berrut, J. and Trefethen, L. (2004). "Barycentric Lagrange Interpolation."](https://people.maths.ox.ac.uk/trefethen/barycentric.pdf) From e1a3cc5e9ebb6495724e11a8a649ca46c0490e37 Mon Sep 17 00:00:00 2001 From: str4d Date: Wed, 17 Feb 2021 06:46:28 +1300 Subject: [PATCH 3/3] book: Evaluation points are elements of fields, not groups Polynomials require both addition and multiplication, which fields have, whereas a group only specifies a single operation. --- book/src/background/polynomials.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/book/src/background/polynomials.md b/book/src/background/polynomials.md index afaf826..6ed4a0c 100644 --- a/book/src/background/polynomials.md +++ b/book/src/background/polynomials.md @@ -14,7 +14,7 @@ the formal indeterminate $X$ with some concrete value $x$, which we denote by $A > The word "point" here stems from the geometrical usage of polynomials in the form > $y = A(x)$, where $(x, y)$ is the coordinate of a point in two-dimensional space. > However, the polynomials we deal with are almost always constrained to equal zero, and -> $x$ will be an [element of some group](fields.md#groups). This should not be confused +> $x$ will be an [element of some field](fields.md). This should not be confused > with points on an [elliptic curve](curves.md), which we also make use of, but never in > the context of polynomial evaluation.